Add Android TV variant

[rootshel]

Hi @ignoramous, @hussainmohd-a — opening this per your note on #2664. Single PR rather than a stack so review is concentrated; happy to split if you'd rather.

What this adds

A new tv product flavor and a Compose-for-TV UI that reuses upstream's existing engine (BraveVPNService, VpnController, AppConfig, PersistentState, Room DB, Koin) verbatim. No upstream behavior changes; the TV variant is purely additive code in app/src/tv/**.

Phone (fdroidFull, playStoreFull, websiteFull) builds and behavior are unchanged; the TV flavor is a separate output (app-fdroid-tv-*.apk).

Tested on

• Sony BRAVIA VH1 (Android 12 / API 31, armeabi-v7a) — real hardware
• Android TV emulator rethink_tv_avd (API 31, arm64-v8a)

App launches, all 9 screens render (Home, DNS, Firewall, Apps, Proxy, Logs, Stats, Rules, Settings + Console), DPAD navigation works, and protection toggles on/off with the tunnel showing live counters.

Per-file rundown

New, TV-only (no risk to phone code):

• app/src/tv/** — 31 files, all under com.celzero.bravedns.tv.*. Compose-for-TV screens that consume the existing upstream services/repos.
• .github/workflows/android-tv.yml — builds the TV flavor on every PR, same shape as the existing android.yml.

Shared app/src/main — additive only:

• ConnectionTrackerDAO.kt — 4 new query overloads adding a :uid filter for the TV per-app logs view. Existing methods unchanged.
• DnsLogDAO.kt — 2 new query overloads adding a :uid filter for the TV per-app DNS log view.
• ODoHEndpointDAO.kt — 1 new suspend fun getAllAsList() so the TV ODoH picker can consume the endpoints from a coroutine. Existing LiveData/PagingSource untouched.
• AppDatabase.kt — wrap buildDatabase() to detect Room cannot verify the data integrity on first open, delete the DB file, and rebuild from the prepackaged asset. Without this, BraveVPNService died on every cold start when upgrading from an older install (its first DAO access hit checkIdentity() after the migration chain). Repro and rationale in the commit message.

Build files:

• build.gradle — Compose Compiler gradle plugin (org.jetbrains.kotlin.plugin.compose) on the buildscript classpath, needed by the project-wide plugin id.
• app/build.gradle — new tv product flavor and AndroidX TV / Compose-for-TV deps. The compose-runtime dep lives on the base implementation configuration (not tvImplementation) because the Compose Compiler plugin's classpath check runs on every variant; phone APK cost is ~250 KB of unused runtime classes.

Things I'd appreciate eyes on

1. Whether you'd rather see the 3 DAO additions land as a separate refactor PR (they're harmless overloads but you may prefer them gated).
2. The AppDatabase schema-mismatch recovery — it's destructive for the user's per-app/firewall customizations on upgrade, but the alternative was a permanent VPN-start crash. Open to a less aggressive approach if you have one in mind.
3. TV sources now live under com.celzero.bravedns.tv, as requested in review.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

Summary by CodeRabbit

• New Features

  • Added a dedicated Android TV experience with remote-friendly navigation and optimized dark-theme interface.
  • Manage VPN protection, DNS resolvers, firewall settings, proxies, WireGuard tunnels, custom rules, logs, statistics, and app-specific controls.
  • Added TV onboarding guidance, search and filtering for logs, endpoint management, and detailed connection insights.
  • Added support for creating custom ODoH endpoints and importing WireGuard configurations.

• Bug Fixes

  • Improved recovery from corrupted local database files to prevent startup and data-access failures.

[github-actions]

[maintainability · low]
The hardcoded 80ms delay before requestFocus() is a fragile timing-based workaround: if the rail's recomposition hasn't settled, the FocusRequester isn't attached yet and runCatching swallows the failure; if it settles sooner, the delay adds avoidable latency. Prefer a more deterministic signal, e.g. request focus from onGloballyPositioned or a frame callback once the item is measured.

[github-actions]

[bug · medium]
The WireGuard detail/import routes are registered as wg/{id} and wg/import, which do not start with the Proxy destination's proxy/ prefix. As a result, currentRoute.startsWith(dest.route + "/") never matches Proxy on these screens (rail highlight is not marked selected), and the parent lookup in the LaunchedEffect(currentRoute) block returns null, skipping focus re-anchoring. Register these routes as proxy/wg/{id} / proxy/wg/import (and update the matching navigation calls) so the Proxy rail item stays selected/focused in sync.

[github-actions]

[bug · medium]
railFocusRequesters is built for every TvDestination including Home, but the Home rail item is wired to firstItemFocus (index == 0 branch) instead, so railFocusRequesters[Home] is never attached to any composable. When the route returns to Home, the re-anchor requestFocus() on railFocusRequesters[Home] fails silently inside runCatching, leaving the rail's focused highlight out of sync with the selected Home item. Use firstItemFocus when parent == Home, or also attach the per-destination requester to the Home item.

[github-actions]

[maintainability · low]
User-facing strings (screen title, toasts, validation message) are hardcoded literals. Move them to string resources (app/src/tv/res/values/strings.xml) so the TV UI can be localized consistently with the rest of the app.

[github-actions]

[bug · high]
When existing is null (first-time setup on a fresh install — the ProxyEndpoint table has no seeded rows and getCustomSocks5Endpoint() returns null), this branch builds ProxyEndpoint(id = 0, ...) and then updateCustomSocks5Proxy/updateCustomHttpProxy persist via Room @Update (ProxyEndpointDAO.update), which matches rows by primary key and silently does nothing when id = 0 doesn't exist. The endpoint is therefore never written to the database; it only lives in AppConfig's in-memory customSocks5Endpoint/customHttpEndpoint cache, so after an app restart the saved proxy is gone and the form loads empty. When creating a new endpoint, insert the row first (e.g., proxyEndpointRepository.insert(ep) and capture the generated id into ep.id) before calling the updateCustom* method.

[github-actions]

[bug · low]
There is no in-flight guard for Save/Disable: rapid double-taps launch concurrent coroutines that write the same endpoint and toggle the proxy state. Depending on completion order, the UI enabled flag and the persisted proxy type/provider can diverge (e.g., Save immediately followed by Disable can leave persistentState enabled while the UI shows disabled, or vice versa). Consider a saving/busy state that disables the buttons while an operation is in flight.

[github-actions]

[maintainability · low]
scope is created via rememberCoroutineScope() but never referenced anywhere else in this composable — dead code. Every call site uses the dedicated LaunchedEffect/produceState scopes instead, so this creates an unnecessary coroutine scope (and a compiler warning). Remove it unless it's needed by a planned follow-up.

[github-actions]

[bug · medium]
The IO work in LaunchedEffect and both produceState blocks is unguarded. WireguardManager.load() performs DB reads (db.getWgConfigs()) and file migration that can throw (e.g. SQLite/IO exceptions); if it does, the exception escapes the LaunchedEffect coroutine and crashes the app, and reloadKey++ never runs. Wrap the load in runCatching/try-catch, log failures, and consider a retry/error state so the screen degrades gracefully instead of crashing on first visit.

Suggestion:

Suggested change

	LaunchedEffect(Unit) {
	withContext(Dispatchers.IO) {
	WireguardManager.load(false)
	}
	reloadKey++
	}
	LaunchedEffect(Unit) {
	withContext(Dispatchers.IO) {
	runCatching { WireguardManager.load(false) }
	.onFailure { Logger.e("ProxyScreen", "wg load failed", it) }
	}
	reloadKey++
	}

[github-actions]

[bug · medium]
ProxyEndpoint.proxyIP is declared as String? (nullable), so a saved proxy endpoint whose IP is null will render the literal string "null:0" as the card value instead of falling back to "Not configured", misleading the user about the actual proxy state. Build the display string with a nested safe-call so a null IP is handled: e.g. appConfig.getSocks5ProxyDetails()?.let { it.proxyIP?.let { ip -> "$ip:${it.proxyPort}" } }.

Suggestion:

Suggested change

	socks5 = appConfig.getSocks5ProxyDetails()?.let { "${it.proxyIP}:${it.proxyPort}" },
	http = appConfig.getHttpProxyDetails()?.let { "${it.proxyIP}:${it.proxyPort}" },
	socks5 = appConfig.getSocks5ProxyDetails()?.let { it.proxyIP?.let { ip -> "$ip:${it.proxyPort}" } },
	http = appConfig.getHttpProxyDetails()?.let { it.proxyIP?.let { ip -> "$ip:${it.proxyPort}" } },

[github-actions]

[other · low]
mapping starts with initialValue = null while produceState loads asynchronously, and the LaunchedEffect's WireguardManager.load(false) runs concurrently, so on the first frame even a valid tunnel briefly renders the misleading 'Tunnel not found.' error before data arrives. Consider showing a loading indicator (or withholding the error text) until the load has settled, and only show 'Tunnel not found.' once loading is actually complete.

[github-actions]

[bug · medium]
All five toggle handlers call WireguardManager's enable/disable/update methods inside scope.launch(Dispatchers.IO) with no try/catch. These methods perform Room DB writes and VpnController proxy updates that can throw (e.g. VPN service not ready), and an uncaught exception in a Compose-launched coroutine propagates to the app's uncaught-exception handler and crashes the TV app. The phone app's WgConfigDetailActivity guards the same calls with preconditions (hasTunnel, canEnableProxy) and try/catch + toast fallbacks. Additionally, these manager methods silently log-and-return when the config isn't found, so the unconditional reloadKey++ re-reads unchanged state and the toggle reverts with no user feedback. Wrap each handler body in try/catch and refresh only on success, surfacing failures to the user (same applies to the LaunchedEffect load and both produceState producers).

[github-actions]

[other · low]
This footer copy promises 'Tap a peer for raw allowed-IPs', but PeerCard is a plain read-only Surface with no clickable/onClick/focus handling — the interaction doesn't exist (the KDoc above also states peer editing is deferred). This is misleading for TV users navigating with a D-pad. Either wire up a tap/focus action for the peer rows or reword the text to describe the read-only nature.

[github-actions]

[other · low]
android.content.Intent and androidx.compose.runtime.LaunchedEffect are imported but never used in this file. Remove them to avoid dead code.

[github-actions]

[bug · medium]
error = null writes Compose snapshot state on Dispatchers.IO before any withContext(Dispatchers.Main) in this coroutine. Compose state should be mutated on the main thread; writing from a background thread can race with UI reads and produce stale/incorrect UI. Move the reset into the Main block (or set it before launching) along with the other state updates.

Suggestion:

Suggested change

	scope.launch(Dispatchers.IO) {
	error = null
	try {
	scope.launch(Dispatchers.IO) {
	try {
	val text = readUri(context, uri)
	withContext(Dispatchers.Main) {
	error = null
	configText = text
	}

[github-actions]

[bug · medium]
ContentResolver.openInputStream(uri) returns a nullable stream. If the document is missing, unreadable, or the permission was revoked, this is null and InputStreamReader(null) throws an NPE (only surfaced later as a cryptic error). The rest of the project handles this explicitly (e.g., TunnelImporter.kt: openInputStream(uri) ?: throw IllegalArgumentException(...)). Add a null check to produce a clean error message instead of an NPE.

Suggestion:

Suggested change

	context.contentResolver.openInputStream(uri).use { stream ->
	return BufferedReader(InputStreamReader(stream)).readText()
	val stream = context.contentResolver.openInputStream(uri)
	?: throw IllegalArgumentException("Could not open file")
	return stream.use { BufferedReader(InputStreamReader(it)).readText() }

[github-actions]

[bug · low]
InputStreamReader(stream) decodes the file using the platform default charset, which varies across devices/regions. WireGuard configs are typically UTF-8; the project already uses StandardCharsets.UTF_8 for this in TunnelImporter.kt. Specify the charset explicitly for deterministic parsing.

Suggestion:

Suggested change

	return BufferedReader(InputStreamReader(stream)).readText()
	return BufferedReader(InputStreamReader(stream, StandardCharsets.UTF_8)).readText()

[github-actions]

[bug · medium]
Rapid repeated clicks (common on TV remotes) can skip state transitions. row.status is captured at composition time, and nextDomainStatus is computed from that stale value each time onSelect fires. If the user presses twice before reloadKey++ triggers a recomposition, both clicks compute the same next from the old status (e.g. NONE→BLOCK twice instead of NONE→BLOCK→TRUST), and the second write also overwrites with the same status. Consider guarding with an in-flight flag (e.g. a var applying by remember per row, or disable the card while updating) so the second click waits for the refreshed status.

[github-actions]

[maintainability · low]
toEntity() constructs CustomDomain with ten positional arguments, which is hard to read and fragile: if the entity constructor parameters are ever reordered, fields such as status/type would be silently mapped to the wrong properties. Using named arguments (matching toRow()) makes the mapping self-documenting and resilient to refactoring.

[github-actions]

[bug · low]
The coroutine launched from onSelect calls applyDomainStatus without any exception handling. If the Room insert or DomainRulesManager helper throws (e.g. a transient SQLite failure), the exception propagates uncaught from a rememberCoroutineScope, which can crash the app and leaves reloadKey unchanged so the UI never refreshes. Wrap the update in runCatching (or try/catch) and log/report the failure so the screen stays usable.

[github-actions]

[maintainability · low]
The status→label/color mapping is duplicated in DomainStatusPill, statusLabel, and nextDomainStatus, and the transition order is hard-coded separately in nextDomainStatus. When a new DomainRulesManager.Status value is added, all three places must be updated consistently or they will diverge. Consider centralizing label, color, and next-state as extension properties/functions on DomainRulesManager.Status (e.g. Status.label, Status.next) and reuse them in all three spots.

[github-actions]

[other · low]
The status cycle never reaches TRUST (NONE→BLOCK→BYPASS_UNIVERSAL→NONE), yet any existing TRUST rule is silently downgraded to NONE on a single OK press, with no confirmation or way to cycle back to Trust. Note the sibling TV screen (CustomDomainRulesList) includes TRUST in its cycle, and the main app (CustomIpRulesBtmSheet) exposes TRUST as a selectable state for IP rules. Please confirm whether TRUST should be part of the universal-rule cycle; if it is intentionally excluded, the TRUST→NONE mapping should be surfaced with a clearer confirm affordance rather than a plain status toggle.

[github-actions]

[bug · low]
The active tab is held by remember { mutableStateOf(RulesTab.DOMAINS) }, so the user's Domains/IPs selection is lost on activity recreation (configuration change or process death) and always resets to the default tab. LogsScreen in this module already preserves its tab via rememberSaveable; use the same here (plus the androidx.compose.runtime.saveable.rememberSaveable import) to keep the selection across recreation.

Suggestion:

Suggested change

	var activeTab by remember { mutableStateOf(RulesTab.DOMAINS) }
	var activeTab by rememberSaveable { mutableStateOf(RulesTab.DOMAINS) }

[github-actions]

[maintainability · low]
All user-facing strings in this screen (Rules, Domains, IPs, Domain rules, IP rules, Scope, Universal only, the subtitle, and the banner copy) are hardcoded Kotlin literals, which prevents localization and triggers HardcodedText lint. Although the rest of the TV module currently uses literals too, app/src/tv/res/values/strings.xml already exists for the tv flavor — consider moving these strings into resources and referencing them via stringResource for consistency and future translation support.

[github-actions]

[maintainability · low]
remember { CoroutineScope(Dispatchers.IO) } creates a manually-managed scope that is never cancelled when this screen leaves composition, and the launched writes have no exception handling — if the intPref commit throws (e.g. disk I/O failure), the exception becomes an uncaught coroutine failure that can crash the app. Other TV screens use the lifecycle-aware rememberCoroutineScope() instead. If writes must be allowed to complete even after navigating away, at least wrap the persistence call in runCatching/try-catch; otherwise prefer rememberCoroutineScope() and launch with Dispatchers.IO.

[github-actions]

[bug · medium]
Each row's onClick launches an independent ioScope.launch { persistentState.dialStrategy = opt.mode } on the multi-threaded Dispatchers.IO. If the user activates two options in quick succession, the two coroutines can run concurrently on different threads, and since the intPref commit order isn't guaranteed, the persisted value may end up different from the last UI selection — after a restart the app can restore a stale strategy. Consider serializing the writes, e.g. persist from a LaunchedEffect(dialStrategy) keyed on the current state, or use a single-writer dispatcher such as Dispatchers.IO.limitedParallelism(1). The same applies to the retry-strategy write below.

[github-actions]

[documentation · low]
Two documentation inaccuracies here: (1) The KDoc says the list mirrors "the four modes we surface on TV", but DialStrategyOptions actually contains five entries. (2) The class-level note that "DESYNC requires firestack ≥ 4.12" conflates the bundled firestack library with the upstream guard: AntiCensorshipActivity checks the device's Linux kernel version via Utilities.isOsVersionAbove412(...) (it reads System.getProperty("os.version") and compares against "4.12"), not the firestack version. Please correct the count and the version rationale so maintainers aren't misled about why DESYNC is exposed unconditionally on TV.

[github-actions]

[bug · high]
The pause observer is captured only once via remember { ... }, but VpnController.getPauseCountDownObserver() returns rvpn?.getPauseCountDownObserver(), which is null whenever the VPN service isn't bound (e.g. opening this settings sub-screen before/without starting the VPN). When it's null at first composition:

1. The fallback MutableLiveData(0L) is observed forever — even after the VPN starts, the screen keeps watching the dummy LiveData and never sees the real countdown, so after pressing a preset the UI never flips to the countdown/Resume state until the route is left and re-entered.
2. MutableLiveData(0L) is constructed inline on every recomposition, and rememberAsImmutableState re-keys produceState on the LiveData reference — each recomposition tears down and re-creates the observer (observer churn).

Since PauseTimer is already imported and its getPauseCountDownObserver() returns the same non-null singleton (pauseCountDownTimer) that VpnController delegates to, observe that directly to keep a stable, always-available observer.

Suggestion:

Suggested change

	val pauseObserver = remember { VpnController.getPauseCountDownObserver() }
	val remaining by rememberAsImmutableState(
	liveData = pauseObserver ?: MutableLiveData(0L),
	initial = 0L,
	) { it ?: 0L }
	val pauseObserver = remember { PauseTimer.getPauseCountDownObserver() }
	val remaining by rememberAsImmutableState(
	liveData = pauseObserver,
	initial = 0L,
	) { it ?: 0L }

[github-actions]

[bug · high]
This starts the pause timer twice. VpnController.pauseApp() already calls BraveVPNService.pauseApp() → startPauseTimer() → PauseTimer.start(PauseTimer.DEFAULT_PAUSE_TIME_MS). The subsequent PauseTimer.start(p.durationMs) launches a second, concurrent countdown coroutine. Both loops decrement the shared PauseTimer.countdownMs AtomicLong every second, so the countdown effectively ticks at 2× speed and the pause expires after about half the selected duration; both loops' finally blocks then call VpnController.resumeApp(). Conversely, if the VPN isn't running (rvpn null), pauseApp() is a no-op while the timer still starts, leaving UI and VPN state out of sync. Ensure PauseTimer.start is invoked exactly once for a pause (e.g. drop the direct call and rely on the timer started by VpnController.pauseApp(), or add a duration parameter to VpnController.pauseApp instead of starting a second loop).

[github-actions]

[style · low]
All user-visible text in this screen is hardcoded ("Pause protection", "How long?", "Resume now", preset labels, etc.) rather than moved to the TV string resources — the new app/src/tv/res/values/strings.xml only defines app_name, so the TV UI cannot be localized. In addition, String.format without an explicit Locale uses the device default locale, which can render digits differently in some locales. Move the strings to resources and pass a fixed locale (e.g. Locale.US) or use padStart for the countdown.

Suggestion:

Suggested change

	text = String.format("%02d:%02d", minutes, seconds),
	text = String.format(Locale.US, "%02d:%02d", minutes, seconds),

[github-actions]

[bug · medium]
PauseTimer.subtractDuration is not clamped. When less than one minute remains, this drives the shared countdownMs negative; the running timer loop then exits and its finally block calls VpnController.resumeApp(), so pressing “−1 min” silently resumes the VPN immediately instead of trimming the countdown. Guard the action (or disable the button) when the remaining time is below PAUSE_VPN_EXTRA_MILLIS.

Suggestion:

Suggested change

	AdjustButton(label = "−1 min") {
	PauseTimer.subtractDuration(PauseTimer.PAUSE_VPN_EXTRA_MILLIS)
	}
	AdjustButton(label = "−1 min") {
	if (remainingMs >= PauseTimer.PAUSE_VPN_EXTRA_MILLIS) {
	PauseTimer.subtractDuration(PauseTimer.PAUSE_VPN_EXTRA_MILLIS)
	}
	}

[github-actions]

[style · low]
androidx.tv.material3.Button and androidx.compose.foundation.layout.PaddingValues are imported but never used in this file. Remove them to keep the imports clean.

[github-actions]

[bug · medium]
remember { CoroutineScope(Dispatchers.IO) } creates a standalone scope that is never cancelled when this composable leaves the composition, so a toggle write still in flight can outlive the screen (unstructured concurrency). composeScope from rememberCoroutineScope() already exists above and is automatically cancelled with the composition — prefer reusing it (e.g. composeScope.launch(Dispatchers.IO) { ... }), exactly as ProtectionModeSection does, instead of introducing a second unmanaged scope.

[github-actions]

[maintainability · low]
All user-visible strings in this screen (title, subtitle, section headers, row titles/descriptions) are hardcoded in Kotlin, which prevents localization and will trigger HardcodedText lint. Since this change set adds app/src/tv/res/values/strings.xml, move these strings into resources and reference them with stringResource(...).

[github-actions]

[bug · medium]
checked = remember { persistentState.allowBypass } freezes the value at first composition. The remember has no keys, and PersistentState properties are plain booleanPref-backed Kotlin vars (not Compose state), so this never re-reads the source and never triggers recomposition. SettingToggleRow only mirrors this frozen checked into its local remember(checked) state, so if the underlying setting changes while the screen is visible (restore, another destination, or tunnel-service adjustments), the toggle silently displays the stale snapshot until the screen is recreated. This applies to all ten toggle rows below. Prefer binding checked to an observable source of truth (e.g. the existing LiveData/Flow) so the rows resync on recomposition.

[github-actions]

[performance · medium]
to is recomputed from System.currentTimeMillis() on every recomposition and then used as a key in remember(tab, to). Because to is not remembered, any incidental recomposition that lands on a new millisecond produces a different key, tearing down and recreating the Pager flow — which restarts the list and re-runs the expensive aggregate SUM queries over ConnectionTracker/DnsLogs. Only recompute it when the window actually changes, and note the screen also has no periodic refresh so data goes stale while it stays open.

Suggestion:

Suggested change

	val to = System.currentTimeMillis() - window.millis
	val to = remember(window) { System.currentTimeMillis() - window.millis }

[github-actions]

[bug · medium]
LoadState.Error is not handled here. When the initial refresh fails, both isLoading and isEmpty are false, so the else branch renders a LazyColumn with itemCount == 0 — a blank screen with no error message or retry option. Consider handling the error state explicitly so users can distinguish a transient DB failure from an actually-empty window.

Suggestion:

Suggested change

	when {
	isLoading -> CenterLabel("Loading…")
	isEmpty -> CenterLabel("No data for this window yet.")
	else -> LazyColumn(
	when {
	isLoading -> CenterLabel("Loading…")
	isEmpty -> CenterLabel("No data for this window yet.")
	items.loadState.refresh is androidx.paging.LoadState.Error -> CenterLabel("Couldn't load stats. Try another tab or window.")
	else -> LazyColumn(

[github-actions]

[style · low]
For TOP_APPS the same byte total is shown twice: formatBytesOrCount in the secondary line renders "1.5 GB • 123 req" while trailing shows "1.5 GB" again, and their fallbacks diverge ("123 req" vs "123"). Consider showing only the request count in the secondary line and the formatted bytes in the trailing column (or vice versa) to avoid redundant/divergent formatting.

[github-actions]

[bug · low]
String.format without an explicit Locale uses the default locale, so in locales with comma decimal separators the output becomes e.g. "1,5 GB" while the rest of the UI uses dot decimals. Use Locale.US (or the locale the rest of the app formats with) for consistent display.

Suggestion:

Suggested change

	return String.format("%.1f %s", v, units[i])
	return String.format(Locale.US, "%.1f %s", v, units[i])

[github-actions]

[bug · low]
This override only replaces the default-locale app_name. The main source set also defines translated app_name entries in app/src/main/res/values-*/strings.xml (e.g. values-ar, values-de, values-ru), which will still win on non-English device locales. So on an Arabic/French/… device the Android TV launcher will show the localized upstream name (e.g. "إعادة التفكير") instead of "Rethink TV", contradicting the comment's intent and the translatable="false" marker. If the TV label must always be "Rethink TV", the tv source set should also override app_name for those locale configurations (or the localized app_name entries should be excluded for this flavor).